From: Greg Kroah-Hartman Date: Mon, 8 Jan 2024 12:48:01 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.14.336~15 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=01ceb5d2b6796d2b1eb1dbbc8a30b88c8b37dbd5;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: mmc-core-cancel-delayed-work-before-releasing-host.patch mmc-rpmb-fixes-pause-retune-on-all-rpmb-partitions.patch --- diff --git a/queue-4.19/mmc-core-cancel-delayed-work-before-releasing-host.patch b/queue-4.19/mmc-core-cancel-delayed-work-before-releasing-host.patch new file mode 100644 index 00000000000..008cfe3627e --- /dev/null +++ b/queue-4.19/mmc-core-cancel-delayed-work-before-releasing-host.patch @@ -0,0 +1,96 @@ +From 1036f69e251380573e256568cf814506e3fb9988 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 4 Dec 2023 12:29:53 +0100 +Subject: mmc: core: Cancel delayed work before releasing host + +From: Geert Uytterhoeven + +commit 1036f69e251380573e256568cf814506e3fb9988 upstream. + +On RZ/Five SMARC EVK, where probing of SDHI is deferred due to probe +deferral of the vqmmc-supply regulator: + + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 0 at kernel/time/timer.c:1738 __run_timers.part.0+0x1d0/0x1e8 + Modules linked in: + CPU: 0 PID: 0 Comm: swapper Not tainted 6.7.0-rc4 #101 + Hardware name: Renesas SMARC EVK based on r9a07g043f01 (DT) + epc : __run_timers.part.0+0x1d0/0x1e8 + ra : __run_timers.part.0+0x134/0x1e8 + epc : ffffffff800771a4 ra : ffffffff80077108 sp : ffffffc800003e60 + gp : ffffffff814f5028 tp : ffffffff8140c5c0 t0 : ffffffc800000000 + t1 : 0000000000000001 t2 : ffffffff81201300 s0 : ffffffc800003f20 + s1 : ffffffd8023bc4a0 a0 : 00000000fffee6b0 a1 : 0004010000400000 + a2 : ffffffffc0000016 a3 : ffffffff81488640 a4 : ffffffc800003e60 + a5 : 0000000000000000 a6 : 0000000004000000 a7 : ffffffc800003e68 + s2 : 0000000000000122 s3 : 0000000000200000 s4 : 0000000000000000 + s5 : ffffffffffffffff s6 : ffffffff81488678 s7 : ffffffff814886c0 + s8 : ffffffff814f49c0 s9 : ffffffff81488640 s10: 0000000000000000 + s11: ffffffc800003e60 t3 : 0000000000000240 t4 : 0000000000000a52 + t5 : ffffffd8024ae018 t6 : ffffffd8024ae038 + status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 + [] __run_timers.part.0+0x1d0/0x1e8 + [] run_timer_softirq+0x24/0x4a + [] __do_softirq+0xc6/0x1fa + [] irq_exit_rcu+0x66/0x84 + [] handle_riscv_irq+0x40/0x4e + [] call_on_irq_stack+0x1c/0x28 + ---[ end trace 0000000000000000 ]--- + +What happens? + + renesas_sdhi_probe() + { + tmio_mmc_host_alloc() + mmc_alloc_host() + INIT_DELAYED_WORK(&host->detect, mmc_rescan); + + devm_request_irq(tmio_mmc_irq); + + /* + * After this, the interrupt handler may be invoked at any time + * + * tmio_mmc_irq() + * { + * __tmio_mmc_card_detect_irq() + * mmc_detect_change() + * _mmc_detect_change() + * mmc_schedule_delayed_work(&host->detect, delay); + * } + */ + + tmio_mmc_host_probe() + tmio_mmc_init_ocr() + -EPROBE_DEFER + + tmio_mmc_host_free() + mmc_free_host() + } + +When expire_timers() runs later, it warns because the MMC host structure +containing the delayed work was freed, and now contains an invalid work +function pointer. + +Fix this by cancelling any pending delayed work before releasing the +MMC host structure. + +Signed-off-by: Geert Uytterhoeven +Tested-by: Lad Prabhakar +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/205dc4c91b47e31b64392fe2498c7a449e717b4b.1701689330.git.geert+renesas@glider.be +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/host.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -489,6 +489,7 @@ EXPORT_SYMBOL(mmc_remove_host); + */ + void mmc_free_host(struct mmc_host *host) + { ++ cancel_delayed_work_sync(&host->detect); + mmc_pwrseq_free(host); + put_device(&host->class_dev); + } diff --git a/queue-4.19/mmc-rpmb-fixes-pause-retune-on-all-rpmb-partitions.patch b/queue-4.19/mmc-rpmb-fixes-pause-retune-on-all-rpmb-partitions.patch new file mode 100644 index 00000000000..a989407eefd --- /dev/null +++ b/queue-4.19/mmc-rpmb-fixes-pause-retune-on-all-rpmb-partitions.patch @@ -0,0 +1,60 @@ +From e7794c14fd73e5eb4a3e0ecaa5334d5a17377c50 Mon Sep 17 00:00:00 2001 +From: Jorge Ramirez-Ortiz +Date: Fri, 1 Dec 2023 16:31:43 +0100 +Subject: mmc: rpmb: fixes pause retune on all RPMB partitions. + +From: Jorge Ramirez-Ortiz + +commit e7794c14fd73e5eb4a3e0ecaa5334d5a17377c50 upstream. + +When RPMB was converted to a character device, it added support for +multiple RPMB partitions (Commit 97548575bef3 ("mmc: block: Convert RPMB to +a character device"). + +One of the changes in this commit was transforming the variable target_part +defined in __mmc_blk_ioctl_cmd into a bitmask. This inadvertently regressed +the validation check done in mmc_blk_part_switch_pre() and +mmc_blk_part_switch_post(), so let's fix it. + +Fixes: 97548575bef3 ("mmc: block: Convert RPMB to a character device") +Signed-off-by: Jorge Ramirez-Ortiz +Reviewed-by: Linus Walleij +Cc: +Link: https://lore.kernel.org/r/20231201153143.1449753-1-jorge@foundries.io +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/block.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -851,9 +851,10 @@ static const struct block_device_operati + static int mmc_blk_part_switch_pre(struct mmc_card *card, + unsigned int part_type) + { ++ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB; + int ret = 0; + +- if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) { ++ if ((part_type & mask) == mask) { + if (card->ext_csd.cmdq_en) { + ret = mmc_cmdq_disable(card); + if (ret) +@@ -868,9 +869,10 @@ static int mmc_blk_part_switch_pre(struc + static int mmc_blk_part_switch_post(struct mmc_card *card, + unsigned int part_type) + { ++ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB; + int ret = 0; + +- if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) { ++ if ((part_type & mask) == mask) { + mmc_retune_unpause(card->host); + if (card->reenable_cmdq && !card->ext_csd.cmdq_en) + ret = mmc_cmdq_enable(card); +@@ -3102,4 +3104,3 @@ module_exit(mmc_blk_exit); + + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Multimedia Card (MMC) block device driver"); +- diff --git a/queue-4.19/series b/queue-4.19/series index ea26c3942be..a97a96bd20a 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -13,3 +13,5 @@ bnxt_en-remove-mis-applied-code-from-bnxt_cfg_ntp_fi.patch mm-memory-failure-check-the-mapcount-of-the-precise-.patch firewire-ohci-suppress-unexpected-system-reboot-in-amd-ryzen-machines-and-asm108x-vt630x-pcie-cards.patch mm-fix-unmap_mapping_range-high-bits-shift-bug.patch +mmc-rpmb-fixes-pause-retune-on-all-rpmb-partitions.patch +mmc-core-cancel-delayed-work-before-releasing-host.patch